OS Command Injection Vulnerability in Minimax Code by Shanghai Xi Yu Ji Zhi Technology
CVE-2026-120275

5.1MEDIUM

Key Information:

Vendor

Shanghai Xi Yu Ji Zhi Technology

Status
Minimax Code
Vendor
CVE Published:
1 November 2026

What is CVE-2026-120275?

A security flaw has been identified in Minimax Code version 0.5.8 from Shanghai Xi Yu Ji Zhi Technology, specifically within the Find Command Handler component. This vulnerability allows an attacker to manipulate the -exec argument, leading to the potential for OS command injection. The attack can be executed remotely, posing significant risks to the integrity of the system. Despite early disclosure to the vendor regarding this vulnerability, there has been no response or mitigation provided.

Affected Version(s)

Minimax Code 0.5.8

References

https://vuldb.com/vuln/429619
vdb-entrytechnical-description
https://vuldb.com/vuln/429619/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-120275
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ShiyuFan_BinYuan (VulDB User)
VulDB CNA Team
.